Compliance Rules API
CRUD for the rules the Compliance Agent evaluates against scripts. Base path /api/db-devops/compliance-rules, Professional+ tier. Reads are open to any licensed user; writes require the admin or release_manager role (403 otherwise).
Rule shape
{ "id": "uuid",
"name": "string",
"description": "string",
"severity": "info" | "warning" | "error",
"isActive": true,
"kind": "regex" | "llm" | "hybrid",
"pattern": "regex string or null",
"patternNegate": false, // true = rule fails when pattern is MISSING
"patternFlags": "i" | "m" | "im",
"category": "string or null",
"appliesToDialects": ["postgresql","mysql"] | null,
"appliesToEnvironments": ["production"] | null,
"remediation": "plain-English fix or null",
"createdBy": "email",
"createdAt": "ISO", "updatedAt": "ISO" }Endpoints
| Method | Endpoint | Role | Description |
|---|---|---|---|
| GET | /compliance-rules | Any licensed | List, ordered by name |
| POST | /compliance-rules | admin / release_manager | Create |
| PUT | /compliance-rules/:id | admin / release_manager | Update (same body; bumps updated_at) |
| DELETE | /compliance-rules/:id | admin / release_manager | Hard delete |
POST /api/db-devops/compliance-rules
For regex and hybrid kinds the pattern must be non-empty and compile server-side; a bad pattern returns 400.
{ "name": "No DROP TABLE",
"description": "Forbid DROP TABLE outside explicit cleanup migrations",
"severity": "error", "kind": "regex",
"pattern": "\\\\bDROP\\\\s+TABLE\\\\b", "patternFlags": "i", "patternNegate": false,
"category": "destructive",
"remediation": "Name the migration drop_legacy_.sql and document why." }
Use patternNegate: true to require presence of a pattern (rule fails when it is absent) — e.g. enforcing that every DDL script wraps in a transaction. To retire a rule while preserving history, set isActive: false via PUT rather than deleting.
Errors
400 — validation failure (invalid regex, missing required field, bad severity/kind)403 — caller lacks admin/release_manager (writes)404 — rule id not found